Notepad++ 正则表达式不起作用

Question

我正在尝试使用 Notepad++ 和正则表达式从 Windows 事件中删除所有 XML。

我的正则表达式如下：

Event Xml:(.|\n)+?Event>\n

Windows 事件示例如下：

Log Name:      System
Source:        Service Control Manager
Date:          2016/04/29 11:54:00
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      hostname.domainname
Description:
The Adobe Flash Player Update Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2016-04-29T10:54:00.113587400Z" />
    <EventRecordID>299771</EventRecordID>
    <Correlation />
    <Execution ProcessID="696" ThreadID="3904" />
    <Channel>System</Channel>
    <Computer>hostname.domainname</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Adobe Flash Player Update Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>410064006F006200650046006C0061007300680050006C0061007900650072005500700064006100740065005300760063002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          2016/04/29 11:54:00
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      hostname.domainname
Description:
The Adobe Flash Player Update Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2016-04-29T10:54:00.113587400Z" />
    <EventRecordID>299770</EventRecordID>
    <Correlation />
    <Execution ProcessID="696" ThreadID="3904" />
    <Channel>System</Channel>
    <Computer>hostname.domainname</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Adobe Flash Player Update Service</Data>
    <Data Name="param2">running</Data>
    <Binary>410064006F006200650046006C0061007300680050006C0061007900650072005500700064006100740065005300760063002F0034000000</Binary>
  </EventData>
</Event>

上述正则表达式适用于http://www.regexpal.com/：

上述正则表达式在 Notepad++ 中不起作用：

Answer 1

删除所有 XML 的正则表达式是什么？

• 菜单“搜索”>“替换”（或Ctrl+ H）

• 将“查找内容”设置为Event Xml:(.*?)Event>

• 将“替换为”设置为空字符串

• 启用“正则表达式”

• 启用“.匹配换行符”

• 点击“全部替换”

  

前：

Log Name:      System
Source:        Service Control Manager
Date:          2016/04/29 11:54:00
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      hostname.domainname
Description:
The Adobe Flash Player Update Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2016-04-29T10:54:00.113587400Z" />
    <EventRecordID>299771</EventRecordID>
    <Correlation />
    <Execution ProcessID="696" ThreadID="3904" />
    <Channel>System</Channel>
    <Computer>hostname.domainname</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Adobe Flash Player Update Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>410064006F006200650046006C0061007300680050006C0061007900650072005500700064006100740065005300760063002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          2016/04/29 11:54:00
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      hostname.domainname
Description:
The Adobe Flash Player Update Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2016-04-29T10:54:00.113587400Z" />
    <EventRecordID>299770</EventRecordID>
    <Correlation />
    <Execution ProcessID="696" ThreadID="3904" />
    <Channel>System</Channel>
    <Computer>hostname.domainname</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Adobe Flash Player Update Service</Data>
    <Data Name="param2">running</Data>
    <Binary>410064006F006200650046006C0061007300680050006C0061007900650072005500700064006100740065005300760063002F0034000000</Binary>
  </EventData>
</Event>

后：

Log Name:      System
Source:        Service Control Manager
Date:          2016/04/29 11:54:00
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      hostname.domainname
Description:
The Adobe Flash Player Update Service service entered the stopped state.


Log Name:      System
Source:        Service Control Manager
Date:          2016/04/29 11:54:00
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      hostname.domainname
Description:
The Adobe Flash Player Update Service service entered the running state.

---

进一步阅读

• 常见问题解答台：在哪里可以找到 REGEX 文档？| Notepad++ 社区
• Notepad++：使用正则表达式和扩展搜索模式的指南
• 正则表达式教程
• RegExr：学习、构建和测试 RegEx
• regex101：在线正则表达式测试器和调试器

Answer 2

正则表达式\r\nEvent Xml:(.|\r\n)+?Event>完全按照预期工作，删除所有实例，而不管文件末尾的换行符如何，并且不启用选项“匹配换行符”。

前：

后：

感谢@DavidPostill 和@Sylordis 帮助我解决这个问题！

Answer 3

您必须在 notepad++ 中检查“匹配新行”选项，否则正则表达式只能逐行考虑。